A little-noticed provision in the Intelligence Authorization Act passed by Congress last week puts restrictions on spy agencies’ ability to keep communications collected overseas, but critics say it does not go far enough to protect Americans’ privacy.

The measure marks the first time Congress, in the wake of revelations by former National Security Agency contractor Edward Snowden about widespread government surveillance, has tried to put some limits in an area of espionage governed expressly by executive authority.

Section 309 of the legislation, which is headed to President Obama’s desk for his signature, specifies that communications that are not gathered through a court order or subpoena shall not be held longer than five years, with some exceptions.

The provision applies to communications collected overseas without court oversight under Executive Order 12333, a Reagan-era directive that spells out surveillance authorities and responsibilities. The executive order covers collection activities that are “reasonably anticipated” to result in gathering of communications to or from a U.S. citizen or resident.

Its supporters include Sen. Ron Wyden (D-Ore.) and outgoing Sen. Mark Udall (D-Colo.), intelligence committee members who were highly critical of certain NSA activities revealed by Snowden, such as the bulk collection of data on Americans’ phone calls.

“While this provision would not place meaningful new restrictions on the NSA, Wyden believes this provision sets a precedent for creating a legislative framework on Executive Order 12333 collection, where there currently is none,” his spokesman Keith Chu said.

Civil liberties advocates said the measure is a step in the right direction but contains numerous loopholes that put Americans’ privacy at risk.

It fails to “fully address the underlying problem: The executive branch is collecting vast amounts of U.S. persons’ information . . . without congressional authorization or appropriate judicial process,” said Neema Guliani, legislative counsel with the American Civil Liberties Union.

Under the provision, a spy agency may keep data longer than five years if, for instance, it is determined to be foreign intelligence or counterintelligence; is believed to constitute evidence of a crime; or if none of the parties to the communication is an American or a U.S. resident. It also allows an agency to keep the data if the agency head decides it is necessary to protect national security and informs Congress in writing.

Some lawmakers said that the rushed nature of the bill, passed by the Senate on Dec. 9 and the House the next day, offered no time for debate over a provision that they contend weakens privacy rights.

“The manner in which this language was inserted late in the process, without real notice to most House Members, is indicative of the lengths that supporters of unwarranted surveillance will go to undercut the Fourth Amendment to the Constitution and is a disservice to Congress,” Rep. Zoe Lofgren (D-Calif.) said in an e-mail. “If members had the opportunity to adequately review this change in law, I sincerely doubt it would have passed.”

House members such as Lofgren said the provision places in statute an authority to collect communications that didn’t exist before. A Senate Intelligence Committee spokesman said the measure provides no new authority for collection or retention.

David Medine, chairman of the Privacy and Civil Liberties Oversight Board, an independent executive branch watchdog, said that imposing retention limits on communications collected by intelligence agencies is “an important statement by Congress that it has the authority and is willing to step in and legislate in a realm that has largely been governed by the executive branch.” He said his view does not necessarily represent those of the board members at large.